24-month retention for Vietnamese user data and what it means for server sizing

If your service stores personal data of users inside Vietnam, a compliance clock starts ticking. The law requires you to retain certain types of user data for a full 24 months. That's not negotiable. It means your server sizing can no longer be done by guesswork, you need to calculate, per user, per record, per month, and multiply by 24. This post walks through exactly that calculation and ties it to real VPS plan choices so you buy what you actually need, not what a sales page suggests.

Which data types fall under the 24-month retention rule?

Decree 53/2022/ND-CP, along with related cybersecurity regulations enforced by the Ministry of Public Security (A05), requires telecommunications and internet service providers, plus any entity offering services on the internet to users in Vietnam, to retain specific data categories. These include:

• User identity information (full name, date of birth, national ID or passport number, address)
• Account registration data including usernames and recovery contacts
• Login/logout timestamps and IP address logs
• Transaction logs (financial or data transactions)
• Content logs where specified (such as posted messages, uploaded files)
• Correspondence metadata including sender, recipient, timestamp

The exact scope depends on the type of service you provide. Social networks, messaging platforms, e-commerce sites, and game services all have specific obligations. For the purpose of this server-sizing exercise, we work with the most common data set: identity records, login logs, and transaction histories.

The two key things every foreign operator needs to know: Viettel (Vietnam's military-run telecom, the largest carrier), VNPT (the state-owned postal and telecom group), and FPT Telecom (the largest private ISP) are the three major infrastructure providers that data centres must interconnect with. Your VPS will sit behind one of these networks, and the retention obligation applies regardless of which network your data traverses.

Why the calculation matters more than plan names

Every VPS provider shows you a menu of specs, 2 GB RAM, 20 GB NVMe, 4 vCPUs. Those numbers are meaningless for compliance if you haven't worked backwards from your data. The 24-month requirement turns a recurring storage question into a fixed-capacity problem: once you know how many records each user generates per month, and the average size of each record, the total disk needed is a multiplication problem.

Get it wrong in either direction and you either run out of storage mid-compliance period, forcing a disruptive migration, or you over-provision and pay for space you never use for years. Getting it right is a one-time calculation that saves real money.

Step 1: Estimate records per user per month

Break down your application into the data categories that must be retained, then estimate how many records per user each category generates monthly. Here is a realistic baseline for a typical web application serving Vietnamese users:

This totals about 45 records per user per month, roughly 22.5 KB per user per month. Identity data is a small one-time addition. Over 24 months, the per-user storage requirement is about 540 KB from logs alone, plus the identity record, roughly 550 KB per user for a simple application.

This is conservative. If your application stores larger payloads (uploaded images, long chat histories, detailed financial records), multiply accordingly. A messaging app with media attachments can easily push 5-10 MB per user per month. Adjust the formula for your specific use case.

24个月的数据保留要求意味着存储规划必须基于实际数据生成量计算，而非凭经验猜测。

The 24-month data retention requirement means storage planning must be calculated from actual data generation rates, not from experience-based guesses.

Step 2: Multiply by your user base and retention period

Take your estimated monthly per-user storage and multiply by the number of users, then by 24. Here is how this works for three common user counts:

For this lightweight log-based application, even 2,000 users consume barely a gigabyte over two years. That is tiny by modern standards. But if your per-user payload is larger, say 1 MB per user per month for an image-heavy platform, the numbers change dramatically:

The heavy scenario is where attention to storage matters. A 500-user image-heavy service needs 12 GB just for retention data, before you add operating system, application code, database indices, temporary files, and backups.

Step 3: Account for system overhead and growth

The calculation above covers raw retention data only. Real server disk also holds:

• Operating system: Ubuntu 24.04 or Debian 12 takes 5-8 GB
• Application code and dependencies: 1-5 GB depending on stack
• Database indexes and temp files: often 30-50% of data size
• Log files outside retention scope: system logs, access logs, error logs, another 1-5 GB
• Backups: you need space for at least one full backup, ideally on the same volume for quick restores
• User growth: 24 months is a long time. If you project 20% user growth per year, your last month serves about 22% more users than your first. Factor that in.

Adding these together, a good rule of thumb: take your 24-month raw retention number and multiply by three. For the heavy scenario with 500 users: 12 GB × 3 = 36 GB needed. For 1,000 users: 24 GB × 3 = 72 GB. For 2,000 users: 48 GB × 3 = 144 GB.

These numbers start to intersect meaningfully with real VPS plans.

Matching the numbers to real VPS plans

With the storage estimate in hand, you can now pick a plan that fits, not one that was guessed by a salesperson. Check current VPS pricing to see how the following tiers compare: plans typically start with a VNLite tier (1 vCPU, 2 GB RAM, 20 GB NVMe) and scale up through VNx1, VNx2, VNx4, and VNx8 (8 vCPU, 16 GB RAM, 100 GB NVMe).

Here is how the storage bands from the previous section map to these tiers:

Notice that for a lightweight application, the baseline VNLite plan works for almost any user count up to several thousand. The heavy scenario is where the VNx range becomes necessary. These plans provide NVMe SSD storage, full root access (or Administrator for Windows VPS), one dedicated IPv4 from the Vietnam range, and unlimited traffic with no data cap. Domestic bandwidth runs at 100 Mbps on a 1 Gbps port (the port is 1 Gbps, the actual throughput is 100 Mbps, the extra port capacity handles burst). International bandwidth is a shared pool, roughly 4 to 10 Mbps, which is fine for backup traffic and occasional admin access but not for serving international users at speed.

A Vietnam VPS is local infrastructure for work that touches Vietnam, users inside the country, local data processing, domestic routing, a Vietnam IPv4. It is not a general-purpose international server. Latency to the US or Europe is high. Use it for what it is good for: serving Vietnamese users with fast local response, and storing Vietnamese data in compliance with local law.

What happens if you do not size correctly

Under-provisioning is the expensive mistake. Running out of disk mid-retention means your application starts failing writes, log entries, user registrations, transactions all break. You then scramble to resize the volume, which requires downtime or a migration, and you may lose data in the process. Over-provisioning wastes monthly spend on storage you never fill.

The correct approach: estimate as shown, add a safety margin (50% above your calculation), and choose a plan. If you need to grow, most VPS providers allow upgrading the plan (more CPU, RAM, disk) with a few minutes of downtime. Start at the tier that fits your 24-month projection plus buffer, and upgrade early if growth exceeds your estimate.

FAQ

中文摘要

越南用户数据需保留24个月，这直接影响VPS存储规划。本文以三种用户量（500、1000、2000人）为例，计算了轻量和重载场景下的存储需求。对于轻量应用，基础VNLite计划即可满足；对于重载应用（每月每用户产生1MB数据），500用户需要约36GB，2000用户需要144GB以上。请根据实际数据生成量计算存储需求，再加50%安全余量选择合适的VPS计划。越南VPS适合服务越南本地用户，境内带宽为100Mbps（端口1Gbps），国际带宽共享约4-10Mbps。

Related articles

• Does Decree 53 require my company to host data in Vietnam?
• What happens after A05 issues a written storage request?
• Do you need a Vietnamese entity to buy hosting in Vietnam?
• Configure swap and optimize memory on a low-ram VPS

Disclaimer: This article provides general information about Decree 53 data retention requirements and server sizing considerations. It does not constitute legal advice. Data compliance laws are complex and subject to change. You should consult a licensed Vietnamese lawyer with cybersecurity expertise for specific legal guidance regarding your service and data handling practices.